~ubuntu-branches/debian/sid/apache2/sid : changes

~ubuntu-branches/debian/sid/apache2/sid » Changes from revision 59

From Revision 59 to 40

Rev	Summary	Authors	Tags	Date
59	Fix typo in conf.d/security comment. Closes: #678740 Fix typo in conf.d/security comment. Closes: #678740	Stefan Fritsch	2.2.22-9	11 years ago
58	[ Stefan Fritsch ] [ Stefan Fritsch ] * CVE-2012-2687: mod_negotiation: Escape filenames in variant list to prevent a possible XSS for a site where untrusted users can upload files to a location with MultiViews enabled. * Add example for X-XSS-Protection to conf.d/security. [ Arno Töll ] * Fix "contradictory comment in /etc/apache2/apache2.conf about the .load suffix" (Closes: #676975). Hopefully you are now happy, Vincent. :-)	Stefan Fritsch	2.2.22-8	11 years ago
57	[ Arno Töll ] [ Arno Töll ] * Fix "ambiguous comment in /etc/apache2/apache2.conf" by clarifying contradicting statements. (Closes: #675184) [ Stefan Fritsch ] * Allow colons in filenames when using wildcards with "Include". Closes: #676610 * Add examples for X-Content-Type-Options and X-Frame-Options to conf.d/security. * Fix the VCS dir example in conf.d/security. * Pick some bug fixes from upstram trunk: - core/mod_cgi: Fix script logging in error case - mod_dumpio: Fix possible loop in input filter. - mod_proxy_ajp: Reduce memory usage in case of many requests on one connection	Stefan Fritsch	2.2.22-7	11 years ago
56	[ Stefan Fritsch ] [ Stefan Fritsch ] * Fix regression causing apache2 to cache "206 partial content" responses, and then serving these partial responses when replying to normal requests. Closes: #671204 * Add section to security.conf that shows how to forbid access to VCS directories. Closes: #548213 * Update ssl default cipher config, add alternative speed optimized config. Closes: #649020 * Add "AddCharset" for .brf files in default mod_mime config. Closes: #402567 * Don't create httpd.conf anymore and don't include it in apache2.conf. If it contains local modifications, move it to /etc/apache2/conf.d/httpd.conf * Port some of the comments in apache2.conf from the 2.4 package. * Compile mod_version statically, drop associated module load file. * If apache2 is not running, make "/etc/init.d/apache2 reload" skip the configtest. * Note in README.Debian that future versions of the package will have the include statements changed to include only .conf. Change compiled-in document root to /var/www, to avoid strange error messages. * Use "dh --with autotools_dev" instead of patching config.sub/config.guess. [ Arno Töll ] * Fix apxs to import LDFLAGS from config_vars.mk. Moreover, make it possible to override LDFLAGS at compile time by defining LDLAGS in the environment, just like it is possible for CFLAGS. This also means, config_vars.mk now exports hardening build flags by default. * Update doc-base metadata for the apache2-doc package.	Stefan Fritsch	2.2.22-6	11 years ago
55	Make LoadFile and LoadModule look in the standard search pat... Make LoadFile and LoadModule look in the standard search paths if the dso file name is given as a pure filename. This helps with the multi-arch transition.	Stefan Fritsch	2.2.22-5	11 years ago
54	CVE-2012-0216: Remove "Alias /doc /usr/share/doc" from the d... CVE-2012-0216: Remove "Alias /doc /usr/share/doc" from the default virtual hosts' config files. If scripting modules like mod_php or mod_rivet are enabled on systems where either 1) some frontend server forwards connections to an apache2 backend server on the localhost address, or 2) the machine running apache2 is also used for web browsing, this could allow a remote attacker to execute example scripts stored under /usr/share/doc. Depending on the installed packages, this could lead to issues like cross site scripting, code execution, or leakage of sensitive data.	Stefan Fritsch	2.2.22-4	12 years ago
53	* Fix "FTBFS: mkdir: cannot create directory `debian/build-t... * Fix "FTBFS: mkdir: cannot create directory `debian/build-tree/arch': No such file or directory". Do not use internal rules targets which clash with build target names ... (Closes: #667069) * Drop apache2-dev virtual package. This had virtually no users but breaks our experimental package in some cases (e.g. #666793) * Push Standards version - no further changes * Update my maintainer address	Arno Töll	2.2.22-3	12 years ago
52	[ Arno Töll ] [ Arno Töll ] Fix "Incorrect debhelper build dependency" by raising the build-dependency of debhelper to 8.9.7 (Closes: #659148)	Stefan Fritsch	2.2.22-2	12 years ago
51	[ Stefan Fritsch ] [ Stefan Fritsch ] * New upstream release, urgency medium due to security fixes: - Fix CVE-2012-0021: mod_log_config: DoS with '%{cookiename}C' log format - Fix CVE-2012-0031: Unprivileged child process could cause the parent to crash at shutdown - Fix CVE-2012-0053: Exposure of "httpOnly" cookies in code 400 error message. * Move httxt2dbm to apache2-utils * Adjust debian/control to point to new git repository. [ Arno Töll ] * Fix "typo in /etc/apache2/apache2.conf" (Closes: #653801)	Stefan Fritsch	2.2.22-1	12 years ago
50	[ Arno Töll ] [ Arno Töll ] Fix build failures introduced as regregression by the previous build. Debian buildds aren't rebuilding arch:all packages which caused problems for our unconditional copying into binary package. I was warned.	Stefan Fritsch	2.2.21-5	12 years ago
49	[ Stefan Fritsch ] [ Stefan Fritsch ] * Security: Fix broken patch for CVE-2011-3607 (Integer overflow in ap_pregsub). * Optimize debian/rules again to improve build time by doing most work in a single parallelized "build-%" target. [ Arno Töll ] * Fix "Suggest removing DefaultType from apache2.conf" change the DefaultType from text/plain to None. This lets the browser guess a proper MIME type instead of being forced to treat a given file according to our default type (Closes: #440058) * Fix "add pre-rotate hook to logrotate script" execute scripts in /etc/logrotate.d/httpd-prerotate if available (Closes: #590096). * Fix "Hide /icons index" Disables indexes on the icon directory. By upgrading to Debian's 3.0/quilt source format also images don't need to be generated at build time anymore. Hence, the icon date can no longer lead to information disclosure (Closes: #649888). * Upgrade package to 3.0/quilt. + Remove uuencoded images, keep them in their binary format in debian/icons + Upgrade to quilt from dpatch and refresh all patches by keeping all hunks unchanged. Remove the `001_branding' patch by supplying -DPLATFORM at build time where needed Move the 200_cp_suexec.dpatch patch and 202_suexec-custom.dpatch patch to debian/rules. 200_cp_suexec.dpatch was a script, not a patch which is not supported by quilt. * Rewrite debian/rules and base it on dh(1). + use overrides where possible, replace some debhelper calls by our own implementation where needed. That's required since the Apache package is compiled in parts several times for each MPM once. + move some install operations to the their respective .install files + Support dpkg-buildflags now, which also enables by default hardening flags. Thus, remove them from their explicit appearance in debian/rules + Remove DEB_BUILD_OPTIONS legacy support. It comes for free when using dh(1)/dpkg-buildflags(1). * Push debhelper compatibility to 8 * Remove unused Lintian overrides for the Debian source package remove and redundant priorities in debian/control. * Add myself to Uploaders	Stefan Fritsch	2.2.21-4	12 years ago
48	* Fix CVE-2011-4317: Prevent unintended pattern expansion in... * Fix CVE-2011-4317: Prevent unintended pattern expansion in some reverse proxy configurations. (Similar to CVE-2011-3368, but different attack vector.) * Fix CVE-2011-3607: Integer overflow in ap_pregsub could cause segfault via malicious .htaccess. * Mention dpkg-statoverride for changing permissions of suexec. LP: #897120 * Fix broken link in docs. Closes: #650528 * Remove Tollef Fog Heen, Thom May, and Peter Samuelson from uploaders. Thanks for your work in the past.	Stefan Fritsch	2.2.21-3	12 years ago
47	* Fix CVE-2011-3368: Prevent unintended pattern expansion in... * Fix CVE-2011-3368: Prevent unintended pattern expansion in some reverse proxy configurations by strictly validating the request-URI. * Correctly set permissions of suexec.load even if umask is 0002 during build. LP: #872000	Stefan Fritsch	2.2.21-2	12 years ago
46	* New upstream release. * New upstream release. - Fixes CVE-2011-3348: Possible denial of service in mod_proxy_ajp if combined with mod_proxy_balancer	Stefan Fritsch	2.2.21-1	12 years ago
45	* New upstream release. * New upstream release. * Fix some regressions related to Range requests caused by the CVE-2011-3192 fix. Closes: #639825 * Add build-arch and build-indep rules targets to make Lintian happy. * Bump Standards-Version (no changes).	Stefan Fritsch	2.2.20-1	12 years ago
44	* Fix CVE-2011-3192: DoS by high memory usage for a large nu... * Fix CVE-2011-3192: DoS by high memory usage for a large number of overlapping ranges. * Reduce default KeepAliveTimeout from 15 to 5 seconds. * Use "linux-any" in build-deps. Closes: #634709 * Improve reload message of a2enmod. Closes: #639291 * Improve description of the prefork MPM. Closes: #634242 * Mention .conf files in a2enmod man page. Closes: #634834	Stefan Fritsch	2.2.19-2	12 years ago
43	* New upstream release. * New upstream release. - Makes apr-md5 the default algorithm for htpasswd, removing the 8 character limit of the crypt()-algorithm. Closes: #539246 - Fixes merging of IndexOptions. Closes: #394688 - Documents why order of ProxyPass and <Proxy> blocks matters in the configuration. See "Workers" section in the mod_proxy documentation. Closes: #560020 * For multiple instance setups, correctly determine the config dir in the init script if it is called via a start/stop link. Closes: #627061 * Make a2enmod's restart hint more cut'n'paste friendly. LP: #770204 * Make it clear in README.multiple-instances that the MPMs are shipped in the apache2.2-bin package.	Stefan Fritsch	2.2.19-1	12 years ago
42	* Fix compilation with OpenSSL without SSLv2 support. Closes... * Fix compilation with OpenSSL without SSLv2 support. Closes: #622049 * Fix link errors with -no-add-needed/--no-copy-dt-needed-entries in htpasswd/htdbm.	Stefan Fritsch	2.2.17-3	13 years ago
41	* New mpm_itk upstream version 2.2.17-01: * New mpm_itk upstream version 2.2.17-01: - Fix CVE-2011-1176: If NiceValue was set, the default with no AssignUserID was to run as root:root instead of the default Apache user and group, due to the configuration merger having an incorrect default configuration. Closes: #618857 * Make exit code of '/etc/init.d/apache2 status' more LSB compatible. Closes: #613969 * Set the default file descriptor limit to 8192 instead of whatever the current limit is (usually 1024). Document how to change it in /etc/apache2/envvars . Closes: #615632 * Fix typo in init script. Closes: #615866 * Add hint in README.Debian about 403 error with mod_dav PUT. Closes: #613438 * Remove some obsolete Depends and Replaces.	Stefan Fritsch	2.2.17-2	13 years ago
40	* New upstream version * New upstream version * Disable md5 in mod_ssl default cipher suite. Closes: #609126 * Fix order of comments in "worker" section in apache2.conf. Closes: #608488	Stefan Fritsch	2.2.17-1	13 years ago

Older »